Add inline content support for secrets

loader/validate.go

@@ -167,7 +167,7 @@ func checkConsistency(project *types.Project) error {
 		if secret.External {
 			continue
 		}
-		if secret.File == "" && secret.Environment == "" {
+		if secret.File == "" && secret.Environment == "" && secret.Content == "" {
 			return fmt.Errorf("secret %q must declare either `file` or `environment`: %w", name, errdefs.ErrInvalid)
 		}
 	}

loader/validate_test.go

@@ -182,6 +182,17 @@ func TestValidateSecret(t *testing.T) {
 		err := checkConsistency(project)
 		assert.NilError(t, err)
 	})
+	t.Run("secret set by inlined content", func(t *testing.T) {
+		project := &types.Project{
+			Secrets: types.Secrets{
+				"foo": types.SecretConfig{
+					Content: "token=TOKEN",
+				},
+			},
+		}
+		err := checkConsistency(project)
+		assert.NilError(t, err)
+	})
 	t.Run("external secret", func(t *testing.T) {
 		project := &types.Project{
 			Secrets: types.Secrets{

schema/compose-spec.json

@@ -731,6 +731,7 @@
       "type": "object",
       "properties": {
         "name": {"type": "string"},
+        "content": {"type": "string"},
         "environment": {"type": "string"},
         "file": {"type": "string"},
         "external": {

validation/validation.go

@@ -28,7 +28,7 @@ type checkerFunc func(value any, p tree.Path) error
 var checks = map[tree.Path]checkerFunc{
 	"volumes.*":                       checkVolume,
 	"configs.*":                       checkFileObject("file", "environment", "content"),
-	"secrets.*":                       checkFileObject("file", "environment"),
+	"secrets.*":                       checkFileObject("file", "environment", "content"),
 	"services.*.develop.watch.*.path": checkPath,
 }
 

validation/validation_test.go

@@ -17,6 +17,7 @@
 package validation
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/compose-spec/compose-go/v2/tree"
@@ -25,72 +26,79 @@ import (
 )
 
 func TestValidateSecret(t *testing.T) {
-	checker := checks["configs.*"]
+	treePaths := []tree.Path{"configs.*", "secrets.*"}
 	tests := []struct {
 		name  string
 		input string
 		err   string
 	}{
 		{
-			name: "file config",
+			name: "file",
 			input: `
 name: test
 file: ./httpd.conf
 `,
 			err: "",
 		},
 		{
-			name: "environment config",
+			name: "environment",
 			input: `
 name: test
 environment: CONFIG
 `,
 			err: "",
 		},
 		{
-			name: "inlined config",
+			name: "inlined",
 			input: `
 name: test
 content: foo=bar
 `,
 			err: "",
 		},
 		{
-			name: "conflict config",
+			name: "conflict",
 			input: `
 name: test
 environment: CONFIG
 content: foo=bar
 `,
-			err: "configs.test: file|environment|content attributes are mutually exclusive",
+			err: "%s: file|environment|content attributes are mutually exclusive",
 		},
 		{
-			name: "missing config",
+			name: "missing",
 			input: `
 name: test
 `,
-			err: "configs.test: one of file|environment|content must be set",
+			err: "%s: one of file|environment|content must be set",
 		},
 		{
-			name: "external config",
+			name: "external",
 			input: `
 name: test
 external: true
 `,
 			err: "",
 		},
 	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			var input map[string]any
-			err := yaml.Unmarshal([]byte(tt.input), &input)
-			assert.NilError(t, err)
-			err = checker(input, tree.NewPath("configs.test"))
-			if tt.err == "" {
+	for _, tp := range treePaths {
+		checker := checks[tp]
+
+		for _, tt := range tests {
+			t.Run(fmt.Sprintf("%s %s", tt.name, tp.Parent()), func(t *testing.T) {
+				var input map[string]any
+				testTreePath := fmt.Sprintf("%s.test", tp.Parent())
+
+				err := yaml.Unmarshal([]byte(tt.input), &input)
 				assert.NilError(t, err)
-			} else {
-				assert.Equal(t, tt.err, err.Error())
-			}
-		})
+				err = checker(input, tree.NewPath(testTreePath))
+				if tt.err == "" {
+					assert.NilError(t, err)
+				} else {
+					assert.Equal(t, fmt.Sprintf(tt.err, testTreePath), err.Error())
+				}
+			})
+		}
 	}
+
 }